Posted
by
Soulskillon Friday February 15, 2013 @07:15PM
from the dutch-politicians-apparently-have-skills dept.

An anonymous reader writes "Dutch Member of Parliament (MP) Henk Krol was fined 750 (US$1,000) by the district court of Oost-Brabant on Friday for breaking and entering the system of the Dutch medical laboratory Diagnostics for You. Krol said he entered the system as an ethical hacker to show that it was easy to access and download confidential medical information. Krol, leader of the Dutch 50plus party, accessed the systems of the laboratory with a login and password he had obtained from a patient of the clinic, who in turn had overheard the information at the laboratory from a psychiatrist that worked there ... In April last year, Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients. He did this to prove how easy it was to get access to the systems, according to the ruling (PDF in Dutch).'"

That is an excellent summary of the judge's decision. The judge argues that by not contacting the systems administrator upon logging in, but instead making copies of confidential data, they went from white hat to black hat.

At the same time, the judge argues, the defendant may not have had criminal intentions. So while the "hackers" crossed the line in their efforts to "expose" the bad security, they were not sent to prison as they are not criminals.

the "hackers" crossed the line in their efforts to "expose" the bad security,
Bad Security? An employee of the lab was overheard speaking the information. They could have the best security in the world, and all it takes is one idiot employee to ruin it.

The username/password in question supposedly were "admin". And it sounds like it was probably overheard because the sharing was routine and the authentication a farce. So perhaps they didn't have a technical problem, but they certainly don't sound blameless.

I think these kind of issues are harmful to everyone because they encourage black-hat hacking (which is trivial), and they discourage whistleblowing. It's perhaps not honorable, but obviously many whistleblowers like the attention. But if that's the

No it's not. The worry is how a patient was close enough to the people working in the lab that they could so easily get hold of a password. A technician in a lab has a direct need to access the patient records, he got exactly as far as he was supposed to with that level of login. If he'd gained access to systems unrelated to that tech's job duties, you'd have been correct.

But as has already been noted, and ruled by the judge, there was nothing ethical about what he did. He should have immediately reported t

I might have missed something, but the alarming part to me was that the MP accessed the patient information by accessing the company's website from outside the building. I agree that the tech in the lab needs access, but would the lab tech at home or the corner coffee shop need access? And if there is a case where someone outside the building needs that kind of access, wouldn't be better to VPN into the network with a preshared key before allowing that kind of access?

If he'd picked up the phone and called the lab, they'd have changed their password, and not the procedures that had someone discuss the password in front of a patient that simply had to not go "LALALLALALLA" while overhearing the conversation.
Of course they would not have changed the procedure, because the procedure undoubtedly already forbids it. The only thing they can do is punish the employee, if they know who it is and change the password.

He's not exposing some inherent weakness in the system, he's using a stolen password to steal documents to showoff his "1337" skillz.

Hmmm...he used one patient's password to access and download a number of different patients confidential information. Yeah, I'd say he exposed a pretty damn severe weakness in the system. It would almost certainly result in fines for whoever was keeping the records under HIPPA/HITECH here in the USA.

But also, here in the USA he would have probably gotten 50 years at hard labor after being persecuted by some obscenely overzealous prosecutor and being added to whatever secret terrorist lists the government ke

Yes he is; it's users.It's not hacking in the modern, limited sense, it's hacking in the traditional sense.There aren't some hacking rules that say "you can't use a password if somebody gives it to you".If the users can't be trusted with passwords (why were they sharing a password with a collegue in the first place?), provide some other (combination of) methods of identification.

This "putz" used one user account to access document which should not have been available to that user account.By changing the URL.

I don't consider this hacking for a completely different reason: this is not hacking in the same way that driving up a one-way street the wrong way is not hacking.It's obviously possible, and if the security of your private customer data relies on the fact that no one happens to disregard your street signs, then you're the putz.

Rosa Parks is actually an example of someone who did think it through before hand. She clerked for a lawyer and previously secured the support of him as well as a/some civil rights groups. Her decision to act might have been entirely her own, but she was comforted in knowing she wasn't alone in making it.

So Rosa Parks deserved to be punished?
Breaking an unjust law to call attention to it doesn't alleviate the consequences of it. Despite what the history textbooks say, Ms. Parks was not just a random black woman who decided to make a stand. She was carefully groomed, the act was carefully planned and timed, and she was more than aware of what the consequences could be. She was likely prepared to end up a martyr. As luck would have it, she didn't have to.

Rosa Parks did what she did knowing she would be punished, that's the whole point of civil disobedience. You do what you believe to be right and in the process force the judicial system to punish you in public, exposing a flaw in the system. If Rosa Parks hadn't kicked up the legal fuss she did then she wouldn't have had an impact that would still be discussed on internet fora decades later.

He could have sent the user id and password to the company stating how he had obtained it and the company would have been made aware of the situation. Instead he decided to be flashy and break the law.

Reference please. I don't see anything in the article about him informing the company he had the credentials before he used them, According to the article he used the credentials and reported the results to a media outlet.

He was in a radio interview for Dutch Radio 2 this morning. He claims that he did contact the company and they replied that they were not interested, and if he had a complaint that he should write them a letter. That will take weeks, meanwhile leaving the door wide open for others to get unauthorized access to confidential patient records.

He was fined because the judge thought he retrieved more records than necessary to show the issue. During the interview he claimed that he did this to show that with this

During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor.

When someone dies because a patient's physician is not available and the records can not be accessed I bet you will have a different opinion about this issue. I would rather have all doctors have access to my records but I would also like to have my doctor informed when another doctors looked at them. That way my doctor, or his staff more likely, can monitor and question who has been accessing my records.

Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.

When an issue is reported and/or a bug needs to be fixed it has to be replicated. How can someone replic

If you ask permission from the site to pen test, they are probably going to say no.

If you are a "so called" ethical hacker, whatever that means, and do it anyway, who is to say you don't find something valuable and keep it? May be you are only "ethical" when you don't find something valuable and then use the experience as free advertising.

If you ask permission from the site to pen test, they are probably going to say no.

If you are a "so called" ethical hacker, whatever that means, and do it anyway, who is to say you don't find something valuable and keep it? May be you are only "ethical" when you don't find something valuable and then use the experience as free advertising.

The nominal fine seems reasonable.

Perhaps the right way to do it would be to mandate sites that deal in medical information be pen tested by reputable hackers who offer such services.

Yeah, it would be 13 325 000 dollars because your currency is going downhill everyday.
Ah, yes. Disinformation is so funny. What's even more funny is how the Euro was the strongest against the dollar 5 years ago, and ever since that time, the Euro has been losing ground against the dollar.

First of all, he's an MP, so the fines are going to be much less than say, a poor nameless student. Second, this may cost him the re-election (or it may not, who knows), in which case the punishment would be much more than simply ~$1000.

He downloaded, viewed and printed medical data from several people. That was more than needed to prove his point. Next to that he made very little effort to contact the company to get the problem fixed and published almost right away.

The judge explicitly explained that the "hacking" itself was good, but it was the way he handled it that was not ethical and that is why is was fined.

Hell, one of the primary goals of hacking, from the start of computer/network related hacking, was to get hold of someone's username and password, which included keylogging, dumpster diving, conning people to reveal their usernames and passwords etc.

Make illegal to get warned that you are insecure and you will deserve being raped by unethical hackers. Is pretty much like suing the ones that could predict quakes [go.com], making sure that noone, ever, will warn you till is too late.

If you read TFA, the judge's decision is quite a bit more nuanced than the summary makes it out to be:

The court, however, agreed with Krol that the detection of defects in the protection of confidential, medical data can serve a substantial public interest. Krol said he acted as a journalist and ethical hacker at the time of the breach.

The fact that he logged into the website and consulted some files was not unlawful, the court said. Similarly, downloading and printing the files to demonstrate the failures and scale of the security risk are defensible, it added. Krol also handled the information carefully because he redacted the printed files, the court noted.

It was however disproportional that Krol proceeded to view and print more files than necessary to prove his point, the court said. In addition, he should have given the laboratory more time to fix the problem and should have tried to contact them more than once before he informed the media, the court said.

Krol only knew of one employee that acted carelessly with login information. "Therefore, the problem was not so acute that immediate use of media was necessary," the court said.

Sounds like the Dutch have some good judges exercising common sense on this issue.

Sounds like the Dutch have some good judges exercising common sense on this issue.

Not at all, they just have the polar opposite to the US legal system.

US: Looked funny at a policeman you say? Lock him up and throw away the key.Netherlands: Killed 8 people in cold blood you say? Well he said he was sorry so put him in a minimum security prison for a week. Make sure he has a widescreen TV and a playstation so he isn't sad.

If you look into the earthquake issue it was not for failing to predict the earthquake, as the headline says, but was for not correcting a spokesman who stated that, since there had been a number of minor earthquakes in the region, the stress in the fault had been relieved and there was no chance of a large earthquake. They were convicted because a number of other scientists confirmed that such a statement was patently false. That caused many people to not take precautions and many people died because of it

In my opinion if you report a system with confidential information to be insecure that would be ethical.If the owner of the system hired him, then it would have been his job. That's something different.

Exactly what part of using an overheard user name and password to access patient information is ethical?I nominate him for the Captain Obvious award for showing a valid user name and password combination gives access to a server.

..the justice department (yes, you read that right) actually had a login to the same database as it was found following the news on this particular case. One has to wonder if the official story (needed because of certain convicts that have their records in the same medical DB) is even a valid reason, and why they would even be allowed within 10 meters of such a sensitive and secret (medical wise) collection of data.While Henk Krol is not a 'true hacker' perhaps, this does raise a lot of questions with regards to the security of any person's data in such a medical database; questions that "Diagnostiek voor U" may want to keep secret, so a "wag the dog" (or more popular "Chewbecca") tactic is followed...

Many of you are probably missing interesting details. The login consisted of a 5 number digit with a password that was exactly the same! Another fact is that Henk Krol DID try to warn 'Diagnostiek voor U', twice! But they sent him away because 'that was not the way to report it'. He had to do it in writing. He also contacted two other governmental organisations responsible for organisations like 'Diagnostiek voor U', but they also sent him away saying it was not their problem. Henk Krol was not fined for the actual hacking, but for going to the press too soon. Come again...?